Network Anomalies Detection by Unsupervised Activity Deviations Extraction

Maudoux, Christophe; Boumerdassi, Selma

doi:10.1109/giis56506.2022.9937022

Cited by 1 publication

(1 citation statement)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For this purpose, we compute digital signatures (DiSi) that are like pictures taken at a specific moment in time and for a particular network slice or zone. This article which is an extension of our previous works [6] describes our network anomalies detection method named "Unsupervised Anomalies Knowledge Flow" using Machine Learning Algorithms (MLAs) to extract DiSi and highlight outliers. Our framework offers three main strong aspects that leads to a versatile model.…”

Section: Introductionmentioning

confidence: 98%

Unsupervised Anomaly Knowledge Flow: a Digital Signatures Extraction Approach

Maudoux,

Boumerdassi

2023

2023 10th International Conference on Wireless Networks and Mobile Communications (WINCOM)

Self Cite

View full text Add to dashboard Cite

Various machine learning or clustering techniques are applicable for identifying anomalous activities or particular events in networks by analysing data flows. In this paper we present our networks anomalies detection system which is based on a framework that we named Unsupervised Anomaly Knowledge Flow. Our approach consists of aggregating pre-processed network flows into well-known areas named sectors. For each sector, data describing users activity are aggregated and split into different equal time-periods. After this step, an unsupervised clustering algorithm is employed to extract the digital signatures defining sectors activity. If a specific sector signature for one specific period differs from others, it means that a network anomaly relative to users activity has been detected. A last step is performed to associate highlighted anomalies with their respective events. This framework originality are its generic, cyclic and fractal aspects. Our experiments have been conducted by using a real dataset captured and provided in 2019 by a major French mobile operator. Our proposed knowledge flow is able to detect anomalies related to real crowded events like the Notre-Dame de Paris fire, concerts or soccer matches. For this study, sectors have been computed by using geographic coordinates defining the base transmitting stations, and anomalies are reliant on network activity features.

show abstract

Section: Introductionmentioning

confidence: 98%